General

  • Target

    11cdb938669d3675222f8edff1cf6064a1fa8ed62f1f9ed3a4f7c2bdba737ad5

  • Size

    1.3MB

  • Sample

    220603-3zg1mseccl

  • MD5

    70c9e97b89485255f89561beb1211278

  • SHA1

    ec4a151666cec396fd37457fd6ccee4e8b087302

  • SHA256

    11cdb938669d3675222f8edff1cf6064a1fa8ed62f1f9ed3a4f7c2bdba737ad5

  • SHA512

    af812fbb65b5d1e98e544af00a34e731ebcb7a58bbef42e45f8d001b3c0f709b90ea73a8055f3e7bde9fc49493bc412da66454266f790a00aa453d5807261bbe

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

vítima

C2

127.0.0.1:81

zopto.zapto.org:20000

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Baþarýyla Yüklendi

  • message_box_title

    Bilgi

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      11cdb938669d3675222f8edff1cf6064a1fa8ed62f1f9ed3a4f7c2bdba737ad5

    • Size

      1.3MB

    • MD5

      70c9e97b89485255f89561beb1211278

    • SHA1

      ec4a151666cec396fd37457fd6ccee4e8b087302

    • SHA256

      11cdb938669d3675222f8edff1cf6064a1fa8ed62f1f9ed3a4f7c2bdba737ad5

    • SHA512

      af812fbb65b5d1e98e544af00a34e731ebcb7a58bbef42e45f8d001b3c0f709b90ea73a8055f3e7bde9fc49493bc412da66454266f790a00aa453d5807261bbe

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks